The CryptoBilis theft is becoming easier to measure and harder to reduce to a single lesson. Bitquery's latest reconstruction counts $102 million taken from 324 wallets across six chains, up from the early estimates between $86 million and $93 million. Ledger has also confirmed that one device belonging to an affected user contained an unauthorised hardware implant.
That confirmation matters, but its scope matters just as much. One implanted device does not prove that every victim received the same modification. The on-chain record strongly indicates that one operator controlled many wallet keys; it cannot reveal how every key was obtained. Our first report on the CryptoBilis drain separates those facts from the remaining hypotheses.
The wider question is no longer only how this theft happened. It is what the incident says about the promise that buying a hardware wallet gives someone sovereignty over their money.
The uncomfortable answer is that self-custody is not a product. It is a chain of trust that a user tries to shorten, one link at a time.
An authorised seller was supposed to be part of the defence
Tampered hardware wallets are not a new idea. That is one reason manufacturers maintain authorised reseller networks: buyers are not expected to reverse engineer a device before trusting it. CryptoBilis appeared in Ledger's own reseller registry for Indonesia, Malaysia and the Philippines. In this case, the channel meant to reduce supply-chain risk became the common point in the investigation.
This does not establish where or by whom devices were modified. It does expose the limit of the label "authorised". Certification can identify a commercial relationship and establish procedures. It cannot provide a continuous, cryptographically provable history of every box between a factory and a customer's hands.
Buying directly from a manufacturer does not remove the trade-off either. A local reseller can offer cash payment, local pickup or less direct disclosure to the manufacturer. That discretion is valuable to people who remember past customer-data leaks or who live with a real risk of physical targeting. The same choice, however, adds another warehouse, employee, courier and inventory system to the path that must remain trustworthy.
Privacy and provenance can therefore pull in opposite directions. The purchase route that reveals less to a manufacturer may require more confidence in the physical distribution chain.
Genuine does not mean untouched
Ledger's Genuine Check authenticates the Secure Element and the software it is allowed to run. That is a meaningful defence against a counterfeit device or unauthorised firmware. It is not an X-ray of the complete product.
Ledger Donjon's own threat model states the boundary directly: a Genuine Check cannot detect an unauthorised physical modification, including a spying implant, if the original Secure Element remains intact. An added component can leave the trusted chip alone and instead observe information moving elsewhere inside the device, such as the path between the secure component and the screen.
Expecting every customer to open a wallet and identify an extra chip is not a solution. Dismantling a device can damage it, destroy evidence and still tell a non-specialist very little. A security model that works only when millions of people can perform hardware forensics does not work at consumer scale.
A healthy device is only the first link
Even perfectly genuine hardware does not make the rest of self-custody automatic. The user still depends on the randomness that creates the recovery phrase, the integrity of the wallet software, the accuracy of the address shown on screen, the secrecy and durability of backups, and the recovery plan that will work years later under stress.
The Coldcard entropy failure we covered this summer illustrated a different link breaking. The device itself could be genuine, yet some models generated seeds from insufficiently unpredictable inputs. Official COLDCARD documentation explains that a user seeking an independent 128 bits of physical entropy needs at least 50 fair, private six-sided dice rolls. A strong BIP-39 passphrase can add a separate secret to the derived wallet, but it also creates another critical item to remember, back up and recover. It does not retroactively make the original words more random.
Then comes verification. Holding the signing keys means nobody else can spend the coins. It does not necessarily mean the owner independently checks the Bitcoin rules or the transactions shown by the wallet. Without a personal full node, most users still ask somebody else's server for their balance, transaction history and view of the chain. Bitcoin Core removes that dependency by validating blocks and transactions locally, but doing so adds storage, bandwidth, maintenance and another piece of software to operate correctly.
The complete stack can include a trusted purchase route, device inspection, independent entropy, a passphrase, geographically separated backups, a tested recovery procedure, multisignature devices from different vendors and a full node. Each measure can remove one failure mode. Each also creates work and, if handled badly, can introduce a new one.
Sovereignty is a practice, not a switch
This is where the usual slogan becomes misleading. "Not your keys, not your coins" describes the legal and technical power of a custodian, but it does not describe the operational burden of replacing that custodian.
Self-custody transfers control to the owner. It also transfers key generation, backup, inheritance, incident response and the consequences of error. There is no help desk capable of reversing a valid Bitcoin transaction signed by a key that an attacker obtained. There may not even be a reliable way to distinguish theft from the owner's own action on-chain.
For a technically capable holder with a meaningful balance, that exchange can be rational. For somebody who struggles to maintain passwords, recognise phishing or preserve a recovery phrase through a house move, the same setup can increase rather than reduce the chance of permanent loss.
The realistic question is not whether self-custody is pure enough. It is which failures a particular person can competently own. A simple signer, collaborative custody, multisignature or a regulated custodian all place trust in different locations. None makes it disappear.
Too difficult for most, essential for everyone
That sounds like an argument against self-custody. In one sense, it is. A model that expects every user to audit a supply chain, create independent entropy, secure backups and run infrastructure is unlikely to become the default for billions of people.
Yet the ability to self-custody may be more important than the number of people who exercise it.
A credible exit changes the behaviour of custodians. If users can withdraw to keys they control, an exchange or bank must compete with the possibility that deposits leave. Developers can build new custody models without requiring a central authority's permission. People facing capital controls, institutional failure or targeted exclusion retain an option that does not depend on the institution denying them access.
Self-custody can therefore be unsuitable for most individuals while remaining systemically essential. The option disciplines the services used by everyone else. Its value is not measured only by how many people keep a seed plate at home; it is also measured by whether users can leave when trust fails.
The CryptoBilis incident does not settle the custody debate. It sharpens it. Sovereignty is not achieved at checkout, and every attempt to remove an intermediary reveals another dependency underneath. The chain of trust may never reach zero. What matters is that users can see its links, decide which ones they are equipped to hold and preserve the right to shorten the chain when they need to.
Security note: the CryptoBilis investigation is still developing. Follow Ledger's official support channels for current instructions. Never share a recovery phrase or enter it into a website, app or support conversation.
This is market analysis, not a recommendation to buy or sell any security.